fix: harden security, fix concurrency bugs, and address review findings

Security:
- rate limit /api/webhook routes per-IP and cap concurrent site syncs
- global SSE connection cap (256) with new sse_gate
- validate ?tail= and cap JSON log responses at 4 MiB
- strip ANSI/CSI/OSC and control bytes from streamed log lines
- redact webhook secret from request log middleware
- scrub host details from /api/health for non-admin viewers
- drop container_id from /api/system/stats/top for non-admins
- generate webhook secrets via crypto/rand; require >=32 chars on insert
- verify iid path consistency in streamContainerLogs
- LimitReader on site webhook body; reject malformed non-empty bodies

Concurrency / correctness:
- stats collector: Stop() no longer hangs without Start(), semaphore
  acquired in parent loop so ctx cancellation short-circuits the queue,
  in-flight tick cancellable via shared base context, zero-ts guard
- webhook handler: replace fire-and-forget goroutine with WaitGroup-tracked
  workers + Drain() wired into graceful shutdown
- $derived(() => ...) mis-idiom fixed in ContainerStats / InstanceCard /
  ProjectCard (returned function instead of value)
- SystemResourcesCard: rename `window` and `t` locals to avoid shadowing
  globalThis.window and the i18n `t` import

Quality / performance:
- replace O(n^2) insertion sort with sort.Slice in stats top
- runMigrations only swallows duplicate-column / already-exists errors
- PruneStatsSamplesBefore wrapped in a transaction
- collapse N+1 in unusedImageStats / pruneImages to one ListAllInstances
  pass; surface DB errors instead of silently treating them as inactive
- run Docker Info + DiskUsage in parallel via errgroup
- container log SSE emits `: ping` heartbeat every 20 s
- imageMatches case-insensitive on registry host (RFC behaviour)
- log warning on invalid stage tag pattern instead of silent skip
- reject malformed non-empty site webhook payloads

Frontend / i18n:
- shared formatBytes utility replaces three local copies
- statsInterval store drives dynamic "no samples / collection disabled"
  copy across ContainerStats and SystemResourcesCard
- top consumers row now shows owner_name (project/stage or site name)
- drop seven `as any` casts on the Settings type; add cloudflare_api_token
  write-only field
- move "Service status", "Docker daemon", "Docker unreachable",
  "Proxy unreachable", "reachable", and "Docker daemon is not reachable."
  strings into en/ru i18n bundles

internal/store/projects.go

@@ -1,13 +1,34 @@
 package store
 
 import (
+	"crypto/rand"
 	"database/sql"
+	"encoding/hex"
 	"errors"
 	"fmt"
 
 	"github.com/google/uuid"
 )
 
+// minWebhookSecretLength is the smallest user-supplied webhook secret accepted
+// at insert time. Auto-generated secrets are 64 hex chars (256 bits); a
+// 32-char floor still leaves > 128 bits of brute-force resistance for hex
+// alphabets and rejects obvious typos / placeholder strings.
+const minWebhookSecretLength = 32
+
+// generateWebhookSecret returns a 256-bit hex-encoded random token. We use
+// crypto/rand directly rather than uuid.New() so the intent ("secret token,
+// not identifier") is explicit and the entropy is unambiguous.
+func generateWebhookSecret() string {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		// crypto/rand is documented to never fail on supported platforms;
+		// fall back to a UUID rather than panicking.
+		return uuid.New().String()
+	}
+	return hex.EncodeToString(b)
+}
+
 // projectCols is the canonical column list for projects queries.
 const projectCols = `id, name, registry, image, port, healthcheck, env, volumes,
 	npm_access_list_id, webhook_secret, created_at, updated_at`
@@ -19,7 +40,9 @@ func (s *Store) CreateProject(p Project) (Project, error) {
 	p.CreatedAt = Now()
 	p.UpdatedAt = p.CreatedAt
 	if p.WebhookSecret == "" {
-		p.WebhookSecret = uuid.New().String()
+		p.WebhookSecret = generateWebhookSecret()
+	} else if len(p.WebhookSecret) < minWebhookSecretLength {
+		return Project{}, fmt.Errorf("webhook_secret must be at least %d characters", minWebhookSecretLength)
 	}
 
 	_, err := s.db.Exec(
@@ -163,7 +186,7 @@ func (s *Store) EnsureProjectWebhookSecret(id string) (string, error) {
 	if project.WebhookSecret != "" {
 		return project.WebhookSecret, nil
 	}
-	secret := uuid.New().String()
+	secret := generateWebhookSecret()
 	if err := s.SetProjectWebhookSecret(id, secret); err != nil {
 		return "", err
 	}

internal/store/static_sites.go

@@ -22,7 +22,9 @@ func (s *Store) CreateStaticSite(site StaticSite) (StaticSite, error) {
 	site.CreatedAt = Now()
 	site.UpdatedAt = site.CreatedAt
 	if site.WebhookSecret == "" {
-		site.WebhookSecret = uuid.New().String()
+		site.WebhookSecret = generateWebhookSecret()
+	} else if len(site.WebhookSecret) < minWebhookSecretLength {
+		return StaticSite{}, fmt.Errorf("webhook_secret must be at least %d characters", minWebhookSecretLength)
 	}
 
 	_, err := s.db.Exec(
@@ -301,7 +303,7 @@ func (s *Store) EnsureStaticSiteWebhookSecret(id string) (string, error) {
 	if site.WebhookSecret != "" {
 		return site.WebhookSecret, nil
 	}
-	secret := uuid.New().String()
+	secret := generateWebhookSecret()
 	if err := s.SetStaticSiteWebhookSecret(id, secret); err != nil {
 		return "", err
 	}

internal/store/stats_samples.go

@@ -139,18 +139,28 @@ func (s *Store) ListSystemStatsSamples(sinceTS int64) ([]SystemStatsSample, erro
 	return out, rows.Err()
 }
 
-// PruneStatsSamplesBefore deletes all samples older than the given unix timestamp
-// from both the container and system stats tables. Returns rows deleted across
-// both tables.
+// PruneStatsSamplesBefore deletes all samples older than the given unix
+// timestamp from both the container and system stats tables in a single
+// transaction so a crash between the two cannot leave one table pruned and
+// the other not. Returns rows deleted across both tables.
 func (s *Store) PruneStatsSamplesBefore(ts int64) (int64, error) {
-	r1, err := s.db.Exec(`DELETE FROM container_stats_samples WHERE ts < ?`, ts)
+	tx, err := s.db.Begin()
+	if err != nil {
+		return 0, fmt.Errorf("begin prune tx: %w", err)
+	}
+	defer tx.Rollback()
+
+	r1, err := tx.Exec(`DELETE FROM container_stats_samples WHERE ts < ?`, ts)
 	if err != nil {
 		return 0, fmt.Errorf("prune container stats samples: %w", err)
 	}
-	r2, err := s.db.Exec(`DELETE FROM system_stats_samples WHERE ts < ?`, ts)
+	r2, err := tx.Exec(`DELETE FROM system_stats_samples WHERE ts < ?`, ts)
 	if err != nil {
 		return 0, fmt.Errorf("prune system stats samples: %w", err)
 	}
+	if err := tx.Commit(); err != nil {
+		return 0, fmt.Errorf("commit prune tx: %w", err)
+	}
 	n1, _ := r1.RowsAffected()
 	n2, _ := r2.RowsAffected()
 	return n1 + n2, nil

internal/store/store.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	_ "modernc.org/sqlite"
@@ -214,8 +215,17 @@ func (s *Store) runMigrations() error {
 	}
 
 	for _, m := range migrations {
-		// Ignore errors from already-applied migrations (duplicate column).
-		_, _ = s.db.Exec(m)
+		if _, err := s.db.Exec(m); err != nil {
+			// "duplicate column" / "already exists" are expected when a
+			// migration has already been applied. Anything else (typo, FK
+			// conflict, real schema bug) must surface, otherwise the store
+			// silently runs against the wrong shape.
+			msg := err.Error()
+			if !strings.Contains(msg, "duplicate column") &&
+				!strings.Contains(msg, "already exists") {
+				return fmt.Errorf("apply migration %q: %w", m, err)
+			}
+		}
 	}
 
 	// Create indexes on foreign key columns for query performance.